In accordance with GDPR Article 28, we maintain a transparent list of all third-party subprocessors that process personal data on behalf of Find The Breach.
Last updated: February 23, 2026 | Version 1.3
We provide 30 days' prior written notice before engaging any new subprocessor or materially changing an existing subprocessor's role. Customers on Enterprise plans receive email notifications and have a 14-day objection window as outlined in our Data Processing Agreement.
To receive notifications about sub-processor changes, subscribe to our sub-processor update list by emailing dpa@findthebreach.com with subject “Sub-Processor Updates Subscribe”. We will notify subscribers at least 30 days before engaging any new sub-processor, in accordance with our Data Processing Agreement.
| Subprocessor | Purpose | Location | Data Processed |
|---|---|---|---|
| Hetzner Online GmbH | Cloud infrastructure & hosting | 🇩🇪 Germany (EU) | Scan results, user accounts, application data |
| Cloudflare, Inc. | CDN, DNS, DDoS protection | 🇺🇸 USA (EU-US DPF) | IP addresses, HTTP request metadata |
| PostgreSQL (Self-Hosted) | Primary database | 🇩🇪 Germany (EU) | All application data, user data, scan data |
| Brevo (Sendinblue) | Transactional email delivery | 🇫🇷 France (EU) | Email addresses, notification content |
| NVD / NIST | CVE vulnerability data enrichment | 🇺🇸 USA (Public Data) | CVE IDs only (no personal data) |
| FIRST.org (EPSS) | Exploit probability scoring | 🇺🇸 USA (Public Data) | CVE IDs only (no personal data) |
| CISA (KEV Catalog) | Known Exploited Vulnerabilities | 🇺🇸 USA (Public Data) | CVE IDs only (no personal data) |
FIRST.org (EPSS) — Added for exploit probability scoring as part of Threat Intelligence Engine. No personal data processed.
CISA KEV Catalog — Added for Known Exploited Vulnerability cross-referencing. Public government data only.
Initial subprocessor list published with Hetzner, Cloudflare, PostgreSQL, Brevo, and NVD.